CVE-2026-88202: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88202) involves a heap-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw remotely to execute arbitrary code without requiring privileges, though user interaction is needed. The vulnerability affects multiple specific versions of the product, and Microsoft has issued an official patch to remediate the issue. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system. No active exploitation in the wild has been reported so far.

An official fix from Microsoft is available and should be applied promptly. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Users should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88202 to ensure their installations are updated to a fixed version.